James Barnes PSC 192, Dr.

Robert Betz Healthcare Policy First Draft, Research Paper Embracing the Machine: Issues in Privacy for Web 2.0 Healthcare Management Its hard to remember the era before the Interneta time of imperfect communication and missed phone calls--where social correspondence was still sometimes conducted via physical letters, and shopping was done exclusively under the shelter of bricks and mortar. Unlike any other invention in the history of mankind, the Internet has revolutionized not only the way that we communicate, but the way that we live every aspect of our lives. From the moment we wake up, to the moment we go to sleep, the Internet, somehow, affects everything that we do. It is as much a part of our lives as the food that we eat and the clothes that we wear. However, in one very specificand very importantinstance, the era before the Internet has only just begun to pass. For our healthcare industry, our economys largest contributor and an intensely personal partner for all Americans, prescriptions are still scribbled on paper and health records are still kept in file cabinets, as many of its daily routines are virtually indistinguishable from those of the 1960s. Although emerging technologies promise to revolutionize the way the business of medicine is conducted, lingering issues have sidelined innovation as the inefficiency of aging practices continues to mount on a healthcare system that is literally devouring our economy. As the internet continues to evolve with our society, the advent of Web 2.0 promises unlimited potential for innovation in the medical administration sphere, but also presents significant privacy issues that violate many of the healthcare principles that Americans value

dearly. Can privacy, the American medical character, and Web 2.0 operate together? While many of the key principles of Web 2.0 and web-based management are clearly incongruent with established healthcare norms, I hope to argue that, by enacting explicit privacy protections for patients and users, we can overcome these latent issues and help to bring medical administration into the twenty first century.

What is Web 2.0? A term that is often confused, and more often misused, the phrase Web 2.0 describes, more than one specific technology, a shift in the paradigm of interaction between people among themselves on the Internet. Because of its broad implications, it is important to properly define in the context of establishing its interactions with the principles governing healthcare in America. Without a proper definition, it could be easy to see the entire Internet as Web 2.0, something patently inaccurate, and not very useful. Web guru Tim OReilly, at a now famous brainstorming session with members of his staff, coined the phrase Web 2.0 as a way to describe a new generation of web platforms revolving around collaboration and shared intelligence. At the very core of his concept, OReilly said, was The Web 2.0 lesson: leverage customer-self service and algorithmic data management to reach out to the entire web, to the edges and not just the center, to the long tail and not just the head.1 The long tail, a concept later articulated in a book by Wired.com editor Chris Anderson2, describes the ability of Web 2.0 products on the Internet (think Amazon.com) to supply to all segments of the demand curve due to the almost non-existent opportunity cost of Internet space. In the context of commerce, this

1 2

What Is Web 2.0 - O'Reilly Media , , 10/21/2009 2009 <http://oreilly.com/web2/archive/what-is-web-20.html>. Wired 12.10: The Long Tail , , 10/21/2009 2009 <http://www.wired.com/wired/archive/12.10/tail.html>.

concept could mean Amazon.com connects an interested reader with a book that would have never been given shelf space at a traditional retailer. In the context of healthcare, it could mean connecting a patient with an obscure disease with a specialist on another continent. To understand Web 2.0, one must accept that it is collaborative, it is democratic, and, most of all, it is focused on platform rather than content. It leverages data from everywhere and, by crowd-sourcing trends, creates a whole larger than the sum of its parts. In clearer language than that provided by OReilly, it is perhaps best described by Time Magazine write Lev Grossman, when explaining the choice of You as the 2006 Person of the Year: It's a story about community and collaboration on a scale never seen before. It's about the cosmic compendium of knowledge Wikipedia and the million-channel people's network YouTube and the online metropolis MySpace. It's about the many wresting power from the few and helping one another for nothing and how that will not only change the world, but also change the way the world changes.3

Health Culture in the U.S. Contrastingly, when discussing the confluence between Web 2.0 and healthcare, one must also understand the character of the United States healthcare system--that is, the values, norms, and culture that people experience on a daily basis through their participation in the healthcare market. At the very core of the majority of Americans attitudes regarding healthcare is privacy and, more specifically, maintaining the doctor-patient relationship. In survey research conducted by pollster Dr. Frank Luntz, 58.3% of Americans listed the doctor-patient relationship as the

Time's Person of the Year: You - TIME , , 10/21/2009 2009 <http://www.time.com/time/magazine/article/ 0,9171,1569514,00.html>.

most important concept to them in healthcare.4 Additionally, according to the 2005 National Consumer Health Privacy survey, 38% less Americans would share medical information with a doctor that was not their own to receive better healthcare. With 67% of Americans concerned about the privacy of the personal healthcare records, Americans clearly and convincingly remain committed to keeping their medical information private and only sharing it with their personal doctor (which, according to the survey, a full 98% are comfortable with)5. In general, the healthcare culture in the United States is hardly the open, collaborative spirit that bred Web 2.0 its better described in the American publics ideal state as a vault, only accessible to a patient and his doctor.

Electronic Records Management Electronic records management is the iteration of many of the Web 2.0 principlesweb as a platform, and algorithmic data managementto the healthcare space. Presenting secure online databases for patients to store personal healthcare data in, such platforms offer the ability to pull in information from across the Web, as well as broadcast it out. Google Health, the largest and most well known ERM platform, states five principle features on its landing page6:

Keep your doctors up-to-date Stop filling out the same paperwork every time you see a new doctor Avoid getting the same lab tests done over and over again because your doctor cannot get copies of your latest results Don't lose your medical records because of a move, change in jobs or health insurance

How Republicans Should Talk About Health Care - TIME , , 10/21/2009 2009 <http://www.time.com/time/nation/ article/0,8599,1896597,00.html>. 5 National Consumer Health Privacy Survey 2005 - CHCF.org , , 10/21/2009 2009 <http://www.chcf.org/topics/ view.cfm?itemID=115694>. 6 Google Health , , 10/21/2009 2009 <http://www.google.com/intl/en-US/health/about/index.html>.

Share your health information securely with a family member, caregiver, or doctor

On first glance, the ability to access healthcare information anywhere and share it electronically with those who need it seems absolutely painfully necessary. In addition to reducing unnecessary paperwork, fraud, and mistakes, it would allow a patients allergies, conditions, and medications to be stored for retrieval, not based on recollection from memory (an attribute which loses usefulness when patients are disoriented or unconscious). In a system using ERM, there would be no need for an ER attending physician to attempt to contact a patients home doctor during a time of urgent need, there would be no lengthy paper records to be lost or destroyed, and doctors would always have accurate information on hand about their patients. ERM Privacy Issues Far from being embraced as the saving grace of healthcare, ERM has caught the focus of the public for the potentially game changing privacy concerns that it introduces to the healthcare system. Although there are many, the most important of these concerns is that, currently, ERM platforms are not covered under the Health Insurance Portability Access and Accountability Act (HIPAA), which established strict privacy guidelines for patient medical information7. Generally, under HIPAA, patients must explicitly allow providers to release information8. Although Googles privacy policy enacts most of the provisions covered under HIPAA, they are not legally enforceable. The consensus by industry partners has been that Google and Microsoft can be trusted not to abuse healthcare information. However, in the spirit of the aforementioned polls, the public does not share this trust. For instance, out of the 40,000 patients that created an EMR in

7 8

Google Health , , 10/21/2009 2009 <http://www.google.com/intl/en-US/health/hipaa.html>. Department of Health and Human Services, HIPAA:For Consumers , , 10/21/2009 2009 <http://www.hhs.gov/ocr/ privacy/hipaa/understanding/consumers/index.html>.

response to launch marketing at Beth Israel Deaconess Medical Center, a Google Health partner, only forty-two have taken any steps to record information. As one official said, `It's not enough for people to sign up and have an account,'' Krasner says. What we measure is transactions,'' such as when people check for potential drug interactions.9 Additionally, a 2006 survey by the Markle Foundation found that, in the context of online healthcare record management 77% of Americans are concerned about health information being used for marketing purposes10. For three quarters of Americans, therefore, it is simply hard to accept that the worlds largest indexers of information are, in the case of healthcare records, not planning on an eventual monetization of what could become the worlds richest and most personal database of human information ever compiled. After all, for instance, Google spends millions each year adapting their AdWords platform to identify and deliver the most personal and relevant results possible. Although they have been demonstrably committed to privacy in the past, the temptation to deliver ads would remain. Despite its dramatic tone, this concern is not a conspiracy theorysome Google partners have confirmed that ads are a possibility in the future.11 Additionally, a 2007 patent filing by Google describes an ad delivery method for an electronic medical record system that would deliver ads to patients based on listed medical information. Of particular note was the section on privacy concerns, where the application stated the following, blazing over the latent privacy issues, and even discussing penalizing a patient for opting out: Beyond the technical challenges, there are privacy concerns about the abovedescribed advertising service. However, it should be possible for patients to request

Rebecca Vessely, " Normal 0 The search is on; Data privacy remains a top concern as Google seeks more users, partners for its new personal health-record platform " Modern Healthcare (2009). 10 Lake Research Partners and American Viewpoint, Connecting For Health Survey, 2006), <http:// www.markle.org/downloadable_assets/research_doc_120706.pdf>. 11 Vessely,

that this feature be disabled for their EMR system or their PHR system. However, insurance companies may raise premiums for patients who disable this feature.12 Another huge privacy concern, one of the more significant externalities of personal electronic health records is the removal of a gatekeeper for privileged information. By putting detailed, comprehensive personal information in reach of a username and password, regardless of how secure the connection is, EMR makes the patient the caretaker of records, and the burden of coercion to them, rather than their providers (who, regardless, are covered by HIPAA) to deliver information. As technologist Stephen Levy points out, The very existence of a detailed health dossier accessible in an instant can make control difficult. What if the government subpoenas the records? What if a potential insurer demands to see all the records, telling you that you can't get a policy if you don't provide them? What if your spouseor even someone you're dating demands to see all your records?13 In these instances, there is generally really nothing that Google, or any other provider, can do. The burden is on the patient.

So little privacy, what to do? To address these privacy issues, The Center for Democracy and Technology has called for comprehensive reform which extends HIPAA to EMRs, as well as codifies existing fair information practices (FIP) including openness and transparency, purpose specification and minimization, collection limitation, use limitation, individual control, data integrity, security safeguards, accountability and oversight, and remedies to address any security breaches or

12

United States Patent Application: 0070282632 , , 10/21/2009 2009 <http://appft1.uspto.gov/ netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&u=/netahtml/PTO/searchadv.html&r=1&p=1&f=G&l=50&d=PG01&S1=20070282632.PGNR.&OS=dn/20070282632&RS=DN/ 20070282632>. 13 Levy: Web Surfer, Heal Thyself | Newsweek The Technologist | Newsweek.com , , 10/21/2009 2009 <http:// www.newsweek.com/id/114712>.

privacy violations14. Regardless of whose recommendations are adopted, it is clear that healthcare integration into Web 2.0 cannot be fully completed without being considered by Congressas long as EMR platforms are exempt from HIPAA, patients will continue to distrust them, regardless of who they are hosted by. The largest issues, however, do not revolve around the current privacy policies of EMR platforms, or whether or not Google Health is covered under HIPAA. To the contrary, they revolve around the future of healthcare and the long tail of Web 2.0. Google Health is not the end of Internet-based healthcare management. As the technology and healthcare industries continue to realize the incredible potential that Web 2.0 provides, a new world will be opened up, where patients could be connected with doctors across the world based on the healthcare profile, where public health officials could track the spread of diseases in real timenot just based on Google searches, and where patients could receive statistically significant statistics on chances of contracting other illnesses, based on the experiences of their family, geography, history, and the millions of people whose healthcare records are also accessible online. Its clear that the world described above does not fit into the paradigm of health culture in the U.S, and its also clear that codifying privacy regulations would essentially seal the chances of having a truly Web 2.0 healthcare system. Is the healthcare system incompatible with Web 2.0? Absolutely. Can we settle for Healthcare 1.5, and finally bring our healthcare system into the twenty first century? With dedicated privacy protection, the American people will finally see that the benefits exceed the costs.

14

Center for Democracy and Technology, Comprehensive Privacy and Security: Critical for Health Information Technology, 2009).

Works Cited

Center for Democracy and Technology. Comprehensive Privacy and Security: Critical for Health Information Technology., 2009. "For Consumers " 10/21/2009 <http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/ index.html>. "Google Health " a. 10/21/2009 <http://www.google.com/intl/en-US/health/about/index.html>. "Google Health " b. 10/21/2009 <http://www.google.com/intl/en-US/health/hipaa.html>. "How Republicans Should Talk About Health Care - TIME " 10/21/2009 <http://www.time.com/ time/nation/article/0,8599,1896597,00.html>. Lake Research Partners and American Viewpoint. Connecting for Health Survey., 2006. <http:// www.markle.org/downloadable_assets/research_doc_120706.pdf>. "Levy: Web Surfer, Heal Thyself | Newsweek The Technologist | Newsweek.com " 10/21/2009 <http://www.newsweek.com/id/114712>. "National Consumer Health Privacy Survey 2005 - CHCF.org " 10/21/2009 <http:// www.chcf.org/topics/view.cfm?itemID=115694>. "Time's Person of the Year: You - TIME " 10/21/2009 <http://www.time.com/time/magazine/ article/0,9171,1569514,00.html>. "United States Patent Application: 0070282632 " 10/21/2009 <http://appft1.uspto.gov/ netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&u=/netahtml/PTO/searchadv.html&r=1&p=1&f=G&l=50&d=PG01&S1=20070282632.PGNR.&OS=dn/ 20070282632&RS=DN/20070282632>. Vessely, Rebecca. " Normal 0 The Search is on; Data Privacy Remains a Top Concern

as Google Seeks More Users, Partners for its New Personal Health-Record Platform " Modern Healthcare (2009). "What Is Web 2.0 - O'Reilly Media " 10/21/2009 <http://oreilly.com/web2/archive/what-is-web20.html>. "Wired 12.10: The Long Tail " 10/21/2009 <http://www.wired.com/wired/archive/12.10/ tail.html>.